Security · 2026-10-29
Orbital Quantum Key Distribution: Micius, IRIS-2 and the Identity Use Case
By J. W. Bouckaert
The numbers from orbit
Micius launched from Jiuquan on 16 August 2016 into an orbit at about 500 km. Liao et al., in "Satellite-to-ground quantum key distribution" (Nature, 2017), record the satellite's mass as 635 kg. Li et al., in "Microsatellite-based real-time quantum key distribution" (Nature, 2025), give the quantum payload as about 250 kg. In the 2017 paper the sifted key rate fell "from ~12 kbit/s at 645 km to ~1 kbit/s at 1200 km"; on the best pass, 273 seconds of link produced 1,671,072 sifted bits and a final secure key of 300,939 bits, about 1.1 kbit/s. The quantum bit error rate sat between 1 and 3 percent. The satellite passed the ground station once a night for about five minutes. The authors limited the experiment "to night-time operation only to avoid sun light", and they noted "the need for reasonably good weather condition". The abstract states the comparison directly: the link was up to twenty orders of magnitude more efficient than the same distance of fibre at 0.2 dB/km.
On 29 September 2017 Micius relayed a key between Xinglong and Graz, 7,600 km apart, and the Chinese Academy of Sciences and the Austrian Academy of Sciences held a 75-minute video conference under AES-128 with the seed refreshed every second, spending about 70 kB of quantum key on about 2 GB of traffic. Liao et al. reported that experiment in "Satellite-relayed intercontinental quantum network" (Physical Review Letters, 2018). In 2020 Yin et al. distributed entangled pairs to two ground stations 1,120 km apart and extracted a key at 0.12 bits per second, "without the need for trusted relays" (Nature, 2020). In 2021 Chen et al. reported "an average secret-key rate of 47.8 kilobits per second for a typical satellite pass", about forty times the 2017 rate of about 1.1 kbit/s, on a network of more than 700 fibre links (Nature, 2021).
Jinan-1 launched on 27 July 2022. Li et al. (Nature, 2025) report a quantum payload of 22.7 kg on a 95.9 kg satellite, and ground stations of about 100 kg against the roughly 13,000 kg stations used with Micius. The published abstract reports "up to 1.07 million bits of secure keys during a single satellite pass" and a secret key between China and South Africa, separated by over 12,900 km. The satellite works as a trusted relay, passes once a night under favourable atmospheric conditions, and the authors list daytime operation and multiple satellites as further work. The European Commission's Quantum Europe Strategy, COM(2025) 363 (2 July 2025), describes China's programme as "now succeeded by Jinan-1".
Europe's constellation, and what its law says about QKD
Europe's answer is written into a regulation. Regulation (EU) 2023/588 established the Union Secure Connectivity Programme, the constellation now called IRIS2, and defines the European Quantum Communication Infrastructure as "an interconnected space, ground and terrestrial infrastructure integrated into the secure connectivity system, using quantum-based technology"; the programme's objectives include integrating EuroQCI into the system, and its governmental service portfolio lists "quantum communication services, such as QKD services". The concession went to the SpaceRISE consortium of SES, Eutelsat and Hispasat, was signed on 16 December 2024 for twelve years at EUR 10.6 billion with services from 2030, and on 7 August 2026 an implementation agreement added 66 satellites, bringing the constellation to 348, 330 in low orbit and 18 in medium, with first launches brought forward to 2029. The first quantum satellite in the plan, Eagle-1, is a SITAEL platform with a Tesat payload operated by SES, launching on Vega C for three years of in-orbit validation; ESA's pages put the launch in late 2026 to early 2027 and the Commission's in late 2027, so the date is best read as 2027.
The same regulation states the limits of the technology it is funding. Recital 15: "To date, QKD technology and products are not sufficiently mature to be used for the protection of EU classified information (EUCI)." Recital 16: the primary solutions to the quantum threat "should be the combination of conventional solutions, post-quantum cryptography and possibly QKD in hybrid approaches". The European programme is building a space segment for QKD while stating in law that post-quantum cryptography is the primary defence and QKD a possible hybrid component. That is also the position of every national security agency that has published one.
The agencies
The NSA's page on quantum key distribution begins: "NSA does not recommend the usage of quantum key distribution and quantum cryptography for securing the transmission of data in National Security Systems (NSS) unless the limitations below are overcome." It lists five. QKD is a partial solution because it "does not provide a means to authenticate the QKD transmission source", so authentication "requires the use of asymmetric cryptography or preplaced keys". It needs special-purpose equipment and "cannot be implemented in software or as a service on a network". It "increases infrastructure costs and insider threat risks" because networks "frequently necessitate the use of trusted relays". Securing and validating it is "a significant challenge". And it "increases the risk of denial of service".
The UK's National Cyber Security Centre, in a whitepaper dated August 2025: "The NCSC will not support the use of QKD for government or military applications." Its reasoning is the same: "QKD does not provide authentication, nor do any other quantum techniques", and "PQC is the best mitigation to the threat to cryptography from quantum computers". The joint position paper of the French, German, Dutch and Swedish agencies, dated January 2024, says QKD "can however currently only be used in practice in some niche use cases" and that the priorities should be "the migration to post-quantum cryptography and/or the adoption of symmetric keying". It addresses satellites directly: "current implementations mostly target non-geostationary orbits so that the availability of these satellites, which is also sensitive to weather conditions, is limited to a short timeframe per day", and "the satellites themselves constitute trusted nodes in most current implementations". It notes that the defining property of QKD, detecting an eavesdropper, "turns each such attempt into a denial-of-service attack", and that claims of "'absolute' or 'unconditional' security allegedly offered by QKD can never apply to actual implementations". NIST's public explainer says QKD systems "still have technological and theoretical loopholes".
The measured record matches the limitations those papers name: night-time passes of a few minutes, dependence on weather, a satellite that holds the key, and rates from about a kilobit per second in 2017 to about a megabit per pass in 2025.
The satellite holds the key
In the prepare-and-measure satellite schemes in these papers, Micius in 2017 and Jinan-1 in 2025, the satellite generates or sees the key material it distributes. Liao et al. (Physical Review Letters, 2018) state it directly: "Micius acts as a trusted relay", performing an exclusive-or of the two ground keys and relaying the result, so that the key "is known only to the two communicating parties and the satellite". Yin et al. (Nature, 2020) distribute entanglement "without the need for trusted relays", at 0.12 bits per second, about one key bit every eight seconds.
The other precondition is authentication. QKD protects a channel between two parties who already know they are talking to each other; without that, an attacker in the middle runs the protocol with each side. ETSI's QKD vocabulary defines a "QKD Authentication Key" as a "shared secret used for authentication mechanisms between two QKD modules" and says such keys "have to be available to the QKD modules before any communication using the QKD link can be established". ETSI's key-delivery interface hands the finished keys to applications over a REST API authenticated by ordinary TLS certificates. The alternative the agencies name is a post-quantum signature scheme, which is to say that a QKD link's authentication rests on the same lattice signatures the link was supposed to make unnecessary.
Identity is the wrong shape for it
Set the two pictures side by side. Orbital QKD produces a symmetric key, at kilobits to a megabit per nightly pass, between two fixed, expensive ground stations that already share an authentication secret, through a satellite that knows the key. Identity verification is a many-to-many problem between parties who have never met, most of them on phones, at millions of decisions a day, where the artefact that has to survive is a signature a stranger can verify later: a credential, an attestation, an audit record. Our earlier post on QKD made the general case; the orbital results sharpen it rather than change it.
| Property | Orbital QKD, as measured | An identity platform's need |
|---|---|---|
| Output | A symmetric key between two endpoints | Signatures verifiable by anyone, and keys for many parties |
| Endpoints | Fixed ground stations, about 100 kg to tonnes | Phones, browsers, servers, agents |
| Availability | One pass per night of a few minutes, weather permitting | Every second |
| Rate | About 1 kbit/s (2017) to about 1 Mbit per pass (2025) | Millions of signatures and verifications a day |
| Trust | The satellite holds the key (except at 0.12 bit/s) | No third party holds the key |
| Authentication | Pre-shared keys or post-quantum signatures, before the link | The thing being provided |
| Failure on attack | Denial of service by design | Fail closed on the decision, keep serving |
Authentication decides that row of the table. A QKD link cannot start until the two ends have authenticated each other by other means. Our credentials carry a detached ML-DSA-65 proof beside their classical signature, as described in the hybrid scheme. The inventory an auditor will ask for is an inventory of signatures and key lifetimes. We use no QKD anywhere. The one role we see for orbital QKD in a regulated institution is the one the agencies allow: key material between an institution's own fixed sites, as a hybrid component alongside post-quantum key exchange, for the small set of links whose confidentiality has to outlast every assumption. That is a link-layer decision inside the institution, and it does not reach the identity layer.
Left open
Three measurements are still open. Li et al. (Nature, 2025) list daytime operation and a constellation of satellites as further work. Eagle-1 is Europe's first in-orbit measurement of this kind: ESA's pages put the launch in late 2026 to early 2027, the Commission's EuroQCI page puts it in late 2027, and COM(2025) 363 schedules it in 2026. The same strategy states that 26 Member States are deploying national terrestrial quantum communication networks. The entanglement-based rate, the configuration in which the satellite does not hold the key, is 0.12 bits per second in Yin et al. (Nature, 2020). If that rate later rises by four or five orders of magnitude, the trusted-node row in the table above changes. We will revisit when there is a measurement to cite. The post-quantum identity work is where our own effort goes, and the specifications above, rather than any launch announcement, are the documents to hold a vendor to.